cognium-dev 3.201.0 → 3.203.0

package/dist/cli.js

@@ -3,9 +3,9 @@ import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/cli.ts
-import { readFileSync, existsSync } from "fs";
+import { readFileSync, existsSync, writeFileSync } from "fs";
 import { stat as stat2, readdir as readdir2 } from "fs/promises";
-import { join as join2, dirname as dirname3, extname, resolve as resolve2, relative as relative4 } from "path";
+import { join as join2, dirname as dirname3, extname, resolve as resolve2, relative as relative4, basename } from "path";
 import { createRequire as createRequire2 } from "module";
 
 // ../../node_modules/web-tree-sitter/web-tree-sitter.js
@@ -45904,6 +45904,341 @@ function deriveProjectRoot(paths) {
   }
   return common.join("/") || "/";
 }
+// ../circle-ir/dist/analysis/sbom.js
+function purlVersion(spec) {
+  const stripped = spec.trim().replace(/^[\s^~=<>]+/, "");
+  if (/^v?[0-9][\w.\-+]*$/.test(stripped))
+    return stripped;
+  return;
+}
+function encodePurlName(name2) {
+  return name2.split("/").map((seg) => encodeURIComponent(seg)).join("/");
+}
+function makePurl(ecosystem, name2, version) {
+  const v = purlVersion(version);
+  const path = ecosystem === "maven" ? name2.replace(":", "/") : name2;
+  const base = `pkg:${ecosystem}/${encodePurlName(path)}`;
+  return v ? `${base}@${encodeURIComponent(v)}` : base;
+}
+function dep(ecosystem, name2, version, scope) {
+  const v = version.trim() || "unknown";
+  return { name: name2, version: v, ecosystem, scope, purl: makePurl(ecosystem, name2, v) };
+}
+function parseNpmDependencies(packageJson) {
+  if (!packageJson)
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(packageJson);
+  } catch {
+    return [];
+  }
+  if (!parsed || typeof parsed !== "object")
+    return [];
+  const obj = parsed;
+  const out2 = [];
+  const sections = [
+    ["dependencies", "required"],
+    ["optionalDependencies", "optional"],
+    ["peerDependencies", "optional"],
+    ["devDependencies", "dev"]
+  ];
+  for (const [key, scope] of sections) {
+    const block = obj[key];
+    if (!block || typeof block !== "object")
+      continue;
+    for (const [name2, spec] of Object.entries(block)) {
+      out2.push(dep("npm", name2, typeof spec === "string" ? spec : "unknown", scope));
+    }
+  }
+  return out2;
+}
+function parsePep508(spec) {
+  let s = spec.trim();
+  s = s.split(";")[0].trim();
+  if (!s)
+    return null;
+  const m = s.match(/^([A-Za-z0-9._-]+)\s*(?:\[[^\]]*\])?\s*(.*)$/);
+  if (!m)
+    return null;
+  const rest = m[2].trim();
+  const verMatch = rest.replace(/^\(/, "").match(/^(?:==|>=|<=|~=|!=|>|<|===)?\s*([^,\s)]+)/);
+  const version = verMatch && verMatch[1] ? verMatch[1] : "unknown";
+  return { name: m[1], version };
+}
+function parsePypiDependencies(requirementsTxt) {
+  if (!requirementsTxt)
+    return [];
+  const out2 = [];
+  for (const raw of requirementsTxt.split(/\r?\n/)) {
+    let line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    if (line.startsWith("-") || /^[a-z]+:\/\//i.test(line))
+      continue;
+    line = line.split("#")[0].trim();
+    if (!line)
+      continue;
+    const parsed = parsePep508(line);
+    if (parsed)
+      out2.push(dep("pypi", parsed.name, parsed.version, "required"));
+  }
+  return out2;
+}
+function parsePyprojectDependencies(pyprojectToml) {
+  if (!pyprojectToml)
+    return [];
+  const out2 = [];
+  const lines = pyprojectToml.split(/\r?\n/);
+  let table = "";
+  let poetryScope = null;
+  let inArray = false;
+  let arrayScope = "required";
+  const pushReq = (raw, scope) => {
+    const cleaned = raw.trim().replace(/^["']|["'],?$/g, "").replace(/,$/, "").trim();
+    if (!cleaned)
+      return;
+    const parsed = parsePep508(cleaned);
+    if (parsed && parsed.name.toLowerCase() !== "python")
+      out2.push(dep("pypi", parsed.name, parsed.version, scope));
+  };
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    if (inArray) {
+      if (line.startsWith("]")) {
+        inArray = false;
+        continue;
+      }
+      pushReq(line, arrayScope);
+      continue;
+    }
+    const header = line.match(/^\[([^\]]+)\]$/);
+    if (header) {
+      table = header[1];
+      if (table === "tool.poetry.dependencies")
+        poetryScope = "required";
+      else if (/^tool\.poetry\.(dev-dependencies|group\..+\.dependencies)$/.test(table))
+        poetryScope = "dev";
+      else
+        poetryScope = null;
+      continue;
+    }
+    const arrayOpen = line.match(/^(dependencies|[A-Za-z0-9._-]+)\s*=\s*\[(.*)$/);
+    if (arrayOpen && (arrayOpen[1] === "dependencies" || table === "project.optional-dependencies")) {
+      arrayScope = arrayOpen[1] === "dependencies" ? "required" : "optional";
+      const inline = arrayOpen[2];
+      if (inline.includes("]")) {
+        for (const item of inline.slice(0, inline.indexOf("]")).split(","))
+          pushReq(item, arrayScope);
+      } else {
+        inArray = true;
+        if (inline.trim())
+          pushReq(inline, arrayScope);
+      }
+      continue;
+    }
+    if (poetryScope) {
+      const kv = line.match(/^([A-Za-z0-9._-]+)\s*=\s*(.+)$/);
+      if (!kv || kv[1].toLowerCase() === "python")
+        continue;
+      let version = "unknown";
+      const strv = kv[2].match(/^["']([^"']+)["']/);
+      if (strv)
+        version = strv[1];
+      else {
+        const inlinev = kv[2].match(/version\s*=\s*["']([^"']+)["']/);
+        if (inlinev)
+          version = inlinev[1];
+      }
+      out2.push(dep("pypi", kv[1], version, poetryScope));
+    }
+  }
+  return out2;
+}
+function parseGradleDependencies(buildGradle) {
+  if (!buildGradle)
+    return [];
+  const out2 = [];
+  const re = /\b(implementation|api|compileOnly|compileOnlyApi|runtimeOnly|testImplementation|testCompileOnly|testRuntimeOnly|annotationProcessor|kapt|classpath)\s*[(\s]\s*['"]([\w.-]+:[\w.-]+(?::[\w.\-+]+)?)['"]/g;
+  let m;
+  while ((m = re.exec(buildGradle)) !== null) {
+    const config = m[1];
+    const coord = m[2].split(":");
+    if (coord.length < 2)
+      continue;
+    const name2 = `${coord[0]}:${coord[1]}`;
+    const version = coord[2] ?? "unknown";
+    const scope = config.startsWith("test") ? "dev" : "required";
+    out2.push(dep("maven", name2, version, scope));
+  }
+  return out2;
+}
+function parseMavenDependencies(pomXml) {
+  if (!pomXml)
+    return [];
+  const out2 = [];
+  const depRe = /<dependency>([\s\S]*?)<\/dependency>/g;
+  let m;
+  while ((m = depRe.exec(pomXml)) !== null) {
+    const block = m[1];
+    const gid = block.match(/<groupId>\s*([^<\s]+)\s*<\/groupId>/)?.[1];
+    const aid = block.match(/<artifactId>\s*([^<\s]+)\s*<\/artifactId>/)?.[1];
+    if (!gid || !aid)
+      continue;
+    let version = block.match(/<version>\s*([^<\s]+)\s*<\/version>/)?.[1] ?? "unknown";
+    if (version.startsWith("${"))
+      version = "unknown";
+    const mvnScope = block.match(/<scope>\s*([^<\s]+)\s*<\/scope>/)?.[1];
+    const optional = /<optional>\s*true\s*<\/optional>/.test(block);
+    const scope = mvnScope === "test" || mvnScope === "provided" ? "dev" : optional ? "optional" : "required";
+    out2.push(dep("maven", `${gid}:${aid}`, version, scope));
+  }
+  return out2;
+}
+function parseCargoDependencies(cargoToml) {
+  if (!cargoToml)
+    return [];
+  const out2 = [];
+  let scope = null;
+  for (const raw of cargoToml.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const section = line.match(/^\[([^\]]+)\]$/);
+    if (section) {
+      const s = section[1];
+      if (s === "dependencies")
+        scope = "required";
+      else if (s === "dev-dependencies")
+        scope = "dev";
+      else if (s === "build-dependencies")
+        scope = "optional";
+      else
+        scope = null;
+      continue;
+    }
+    if (!scope)
+      continue;
+    const kv = line.match(/^([A-Za-z0-9._-]+)\s*=\s*(.+)$/);
+    if (!kv)
+      continue;
+    const name2 = kv[1];
+    const value = kv[2].trim();
+    let version = "unknown";
+    if (value.startsWith('"') || value.startsWith("'")) {
+      version = value.replace(/^["']|["'].*$/g, "");
+    } else {
+      const inline = value.match(/version\s*=\s*["']([^"']+)["']/);
+      if (inline)
+        version = inline[1];
+    }
+    out2.push(dep("cargo", name2, version, scope));
+  }
+  return out2;
+}
+function parseGoDependencies(goMod) {
+  if (!goMod)
+    return [];
+  const out2 = [];
+  let inBlock = false;
+  for (const raw of goMod.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("//"))
+      continue;
+    if (!inBlock && /^require\s*\($/.test(line)) {
+      inBlock = true;
+      continue;
+    }
+    if (inBlock && line === ")") {
+      inBlock = false;
+      continue;
+    }
+    let spec;
+    if (inBlock)
+      spec = line;
+    else if (/^require\s+/.test(line))
+      spec = line.replace(/^require\s+/, "");
+    else
+      continue;
+    const indirect = /\/\/\s*indirect/.test(spec);
+    spec = spec.replace(/\/\/.*$/, "").trim();
+    const m = spec.match(/^(\S+)\s+(\S+)$/);
+    if (!m)
+      continue;
+    out2.push(dep("golang", m[1], m[2], indirect ? "optional" : "required"));
+  }
+  return out2;
+}
+function toCycloneDx(deps, meta = {}) {
+  const bom = {
+    bomFormat: "CycloneDX",
+    specVersion: "1.5",
+    version: 1
+  };
+  if (meta.serialNumber)
+    bom.serialNumber = meta.serialNumber;
+  const metadata2 = {};
+  if (meta.timestamp)
+    metadata2.timestamp = meta.timestamp;
+  metadata2.tools = [{ vendor: "Cognium", name: meta.tool ?? "circle-ir" }];
+  if (meta.name) {
+    metadata2.component = {
+      type: "application",
+      name: meta.name,
+      ...meta.version ? { version: meta.version } : {}
+    };
+  }
+  bom.metadata = metadata2;
+  bom.components = deps.map((d) => ({
+    type: "library",
+    name: d.name,
+    version: d.version,
+    purl: d.purl,
+    scope: d.scope === "dev" ? "excluded" : d.scope === "optional" ? "optional" : "required",
+    "bom-ref": d.purl
+  }));
+  return bom;
+}
+function spdxId(raw) {
+  return raw.replace(/[^a-zA-Z0-9.-]/g, "-");
+}
+function toSpdx(deps, meta = {}) {
+  const docName = meta.name ?? "document";
+  const packages = deps.map((d, i2) => ({
+    SPDXID: `SPDXRef-Package-${spdxId(d.ecosystem)}-${spdxId(d.name)}-${i2}`,
+    name: d.name,
+    versionInfo: d.version,
+    downloadLocation: "NOASSERTION",
+    filesAnalyzed: false,
+    externalRefs: [
+      {
+        referenceCategory: "PACKAGE-MANAGER",
+        referenceType: "purl",
+        referenceLocator: d.purl
+      }
+    ]
+  }));
+  const relationships = packages.map((p) => ({
+    spdxElementId: "SPDXRef-DOCUMENT",
+    relatedSpdxElement: p.SPDXID,
+    relationshipType: "DESCRIBES"
+  }));
+  return {
+    spdxVersion: "SPDX-2.3",
+    dataLicense: "CC0-1.0",
+    SPDXID: "SPDXRef-DOCUMENT",
+    name: docName,
+    documentNamespace: meta.namespace ?? `https://cognium.dev/spdxdocs/${spdxId(docName)}`,
+    creationInfo: {
+      created: meta.timestamp ?? "1970-01-01T00:00:00Z",
+      creators: [`Tool: ${meta.tool ?? "circle-ir"}`]
+    },
+    packages,
+    relationships
+  };
+}
 // ../project-profile-detect/dist/index.js
 import { relative as relative3 } from "path";
 
@@ -46515,7 +46850,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.201.0";
+var version = "3.203.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -47116,6 +47451,7 @@ USAGE:
 COMMANDS:
   scan <path>          Scan files or directories for security vulnerabilities
   metrics <path>       Report software quality metrics for files or directories
+  sbom <path>          Generate a Software Bill of Materials from project manifests
   list-passes [cat]    List all analysis passes (optionally filter by category)
   init                 Initialize a configuration file in your project
   version              Display version information
@@ -47164,6 +47500,18 @@ METRICS OPTIONS:
   -o, --output <file>        Write results to file
   -q, --quiet                Suppress progress output
 
+SBOM OPTIONS:
+  -f, --format <format>      SBOM format (cyclonedx|spdx) [default: cyclonedx]
+                               - cyclonedx: CycloneDX 1.5 JSON (OWASP)
+                               - spdx:      SPDX 2.3 JSON (Linux Foundation)
+  --name <name>              Project name in the document [default: package.json name or dir]
+  --prod-only                Exclude dev/test dependencies
+  --deterministic            Omit timestamp / serialNumber / namespace for reproducible output
+  -o, --output <file>        Write the document to a file (default: stdout)
+                               Discovers package.json / requirements.txt / pyproject.toml /
+                               pom.xml / build.gradle(.kts) / Cargo.toml / go.mod.
+                               CVE matching is out of scope (deterministic SAST — no network).
+
 EXAMPLES:
   cognium-dev scan src/
   cognium-dev scan app.java -f json -o results.json
@@ -47181,6 +47529,9 @@ EXAMPLES:
   cognium-dev metrics src/
   cognium-dev metrics src/ --category complexity
   cognium-dev metrics src/ --format json --profile custom-config.json
+  cognium-dev sbom .                                 # CycloneDX 1.5 to stdout
+  cognium-dev sbom . -f spdx -o sbom.spdx.json       # SPDX 2.3 to a file
+  cognium-dev sbom . --prod-only --deterministic     # reproducible, no dev deps
   cognium-dev list-passes
   cognium-dev list-passes reliability
   cognium-dev init
@@ -47886,8 +48237,8 @@ async function runScan(targetPath, options) {
           output = formatResults(results, options.verbose, crossFileData, profileSummary);
       }
       if (options.output) {
-        const { writeFileSync } = await import("fs");
-        writeFileSync(options.output, output);
+        const { writeFileSync: writeFileSync2 } = await import("fs");
+        writeFileSync2(options.output, output);
         console.error(colors.green(`Results written to ${options.output}`));
       } else if (output.trim()) {
         console.log(output);
@@ -48040,8 +48391,8 @@ async function runMetrics(targetPath, options) {
 `);
     }
     if (options.output) {
-      const { writeFileSync } = await import("fs");
-      writeFileSync(options.output, output);
+      const { writeFileSync: writeFileSync2 } = await import("fs");
+      writeFileSync2(options.output, output);
       console.error(colors.green(`Results written to ${options.output}`));
     } else {
       console.log(output);
@@ -48149,8 +48500,8 @@ async function handleInit() {
     severity: "low",
     categories: ["security", "reliability", "performance", "maintainability", "architecture"]
   };
-  const { writeFileSync } = await import("fs");
-  writeFileSync(configPath, JSON.stringify(config, null, 2));
+  const { writeFileSync: writeFileSync2 } = await import("fs");
+  writeFileSync2(configPath, JSON.stringify(config, null, 2));
   console.log(colors.green(`Created ${configPath}`));
 }
 function applyLogLevel(cliValue) {
@@ -48196,6 +48547,95 @@ function parseCrossFileBudgetMs(raw) {
   }
   return n;
 }
+var SBOM_MANIFESTS = {
+  "package.json": parseNpmDependencies,
+  "requirements.txt": parsePypiDependencies,
+  "pyproject.toml": parsePyprojectDependencies,
+  "pom.xml": parseMavenDependencies,
+  "build.gradle": parseGradleDependencies,
+  "build.gradle.kts": parseGradleDependencies,
+  "Cargo.toml": parseCargoDependencies,
+  "go.mod": parseGoDependencies
+};
+var SBOM_SKIP_DIRS = /^(node_modules|vendor|target|dist|build|out|coverage)$/;
+async function collectManifestFiles(targetPath) {
+  const found = [];
+  const pathStat = await stat2(targetPath);
+  if (pathStat.isFile()) {
+    if (SBOM_MANIFESTS[basename(targetPath)])
+      found.push(targetPath);
+    return found;
+  }
+  const walk2 = async (dir) => {
+    for (const e of await readdir2(dir, { withFileTypes: true })) {
+      if (e.name.startsWith("."))
+        continue;
+      if (e.isDirectory()) {
+        if (SBOM_SKIP_DIRS.test(e.name))
+          continue;
+        await walk2(join2(dir, e.name));
+      } else if (SBOM_MANIFESTS[e.name]) {
+        found.push(join2(dir, e.name));
+      }
+    }
+  };
+  await walk2(targetPath);
+  return found;
+}
+async function runSbom(targetPath, options) {
+  const absPath = resolve2(targetPath);
+  if (!existsSync(absPath)) {
+    console.error(colors.red(`Error: path not found: ${targetPath}`));
+    process.exit(2);
+  }
+  const manifests = await collectManifestFiles(absPath);
+  if (manifests.length === 0) {
+    console.error(colors.red("Error: no supported manifests found (package.json, requirements.txt, pyproject.toml, pom.xml, build.gradle, Cargo.toml, go.mod)"));
+    process.exit(1);
+  }
+  let deps = [];
+  let projectName = options.name;
+  for (const m of manifests) {
+    const content = readFileSync(m, "utf-8");
+    deps.push(...SBOM_MANIFESTS[basename(m)](content));
+    if (!projectName && basename(m) === "package.json") {
+      try {
+        const n = JSON.parse(content).name;
+        if (typeof n === "string" && n)
+          projectName = n;
+      } catch {}
+    }
+  }
+  const seen = new Set;
+  deps = deps.filter((d) => {
+    const key = `${d.ecosystem}|${d.name}|${d.version}|${d.scope}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+  if (options.prodOnly)
+    deps = deps.filter((d) => d.scope !== "dev");
+  if (!projectName)
+    projectName = basename(absPath) || "project";
+  const meta = { name: projectName, tool: "cognium-dev" };
+  if (!options.deterministic) {
+    meta.timestamp = new Date().toISOString();
+    const { randomUUID } = await import("crypto");
+    meta.serialNumber = `urn:uuid:${randomUUID()}`;
+    meta.namespace = `https://cognium.dev/spdxdocs/${projectName}-${randomUUID()}`;
+  }
+  const doc = options.format === "spdx" ? toSpdx(deps, meta) : toCycloneDx(deps, meta);
+  const out2 = JSON.stringify(doc, null, 2);
+  if (options.output) {
+    writeFileSync(options.output, out2);
+    console.error(colors.green(`SBOM written to ${options.output} — ${deps.length} dependencies from ${manifests.length} manifest(s)`));
+  } else {
+    console.log(out2);
+    console.error(colors.green(`SBOM: ${deps.length} dependencies from ${manifests.length} manifest(s)`));
+  }
+  process.exit(0);
+}
 async function main() {
   const { command, args: args2, options } = parseArgs(process.argv.slice(2));
   applyLogLevel(options["log-level"]);
@@ -48236,6 +48676,28 @@ Usage: cognium-dev metrics <path> [options]`);
     await runMetrics(targetPath, metricsOptions);
     return;
   }
+  if (command === "sbom") {
+    if (args2.length === 0) {
+      console.error(colors.red("Error: sbom command requires a path argument"));
+      console.error(`
+Usage: cognium-dev sbom <path> [--format cyclonedx|spdx] [--output <file>]`);
+      process.exit(1);
+    }
+    const rawFormat = (options.format || options.f || "cyclonedx").toLowerCase();
+    if (rawFormat !== "cyclonedx" && rawFormat !== "spdx") {
+      console.error(colors.red(`Error: unknown SBOM format '${rawFormat}' (expected 'cyclonedx' or 'spdx')`));
+      process.exit(1);
+    }
+    const sbomOptions = {
+      format: rawFormat,
+      output: options.output || options.o,
+      name: options.name,
+      prodOnly: options["prod-only"] === true || options.prod === true,
+      deterministic: options.deterministic === true
+    };
+    await runSbom(args2[0], sbomOptions);
+    return;
+  }
   if (command === "scan") {
     if (args2.length === 0) {
       console.error(colors.red("Error: scan command requires a path argument"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.201.0",
+  "version": "3.203.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.201.0"
+    "circle-ir": "^3.203.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",